Singapore warns of critical PHP vulnerabilities that could expose web servers to hackers

PHP is a programming language used to create and operate parts of websites and online services. It commonly runs on a web server, where it helps process requests and generate the content delivered to visitors. The article describes PHP as widely used to power websites and services worldwide.

For example, when a visitor opens a page, a server may use PHP to process information, connect with stored data, and prepare the page’s response. PHP may also be included inside third-party applications or components. That means an organisation could use PHP without recognising it as part of its main website.

PHP’s broad role makes security updates especially important. CSA told organisations to identify systems running any PHP version, including web servers supporting third-party software. The advisory gives internet-facing systems priority because they are reachable from outside an organisation and could be targeted before defenders patch them.

The vulnerabilities are considered critical because they may allow attackers to exploit affected systems without valid login credentials. That removes an important barrier to attack. The article says working exploits had already been demonstrated, so the danger was not merely theoretical. Security patches were released on October 21.

In practical terms, an attacker may send specially formed requests to a vulnerable PHP-powered system. If PHP handles those requests incorrectly, the attacker could make the server perform actions the attacker chooses. The article links the flaws to possible control of web servers, theft of data, and disruption of services.

The immediate concern is exposure before organisations patch their systems. CSA urged organisations to find every system running PHP and apply updates, giving priority to internet-facing systems. The vulnerabilities were identified as “PHP2Shell” and CVE-2026-109618 and CVE-2026-109619.

The flaws could let attackers interact with vulnerable PHP systems without first proving who they are. If the system accepts a malicious request and PHP processes it unsafely, the attacker may cause the server to perform unauthorised actions. This is why CSA warned about possible server takeover rather than only minor website errors.

For example, an attacker might target a public website using a vulnerable PHP installation. A successful exploit could allow changes to the server’s operation, access to information stored there, or interference with the services it provides. The article does not describe the exploit’s exact technical steps, but it confirms these possible outcomes.

The risk is immediate because working exploits have been demonstrated. Organisations must identify PHP on web servers, including through third-party applications or components, then install the released security updates. Delayed patching could leave publicly reachable services exposed to attackers.

The article describes PHP as widely used and says countless websites and online services worldwide may be affected. It does not provide a precise count of websites, services, or organisations running PHP. Therefore, the potential scale can be described only broadly, not as a confirmed number.

PHP may be present in a website’s own code or inside a third-party application or component. For example, an organisation might believe its primary site does not use PHP, while another application on its web server does. CSA specifically told organisations to check for that hidden or indirect use.

This broad deployment explains the urgency of the advisory. Organisations must identify systems running any PHP version, especially those exposed to the internet, and apply security updates. The article also says CSA is working with government agencies, critical information infrastructure owners, enterprises, partners, and smaller organisations.

Internet-facing systems deserve priority because they are connected to the public internet and can receive requests from outside an organisation. An attacker does not need physical access to reach such a service. If it runs vulnerable PHP, the system may be exposed to attempts to exploit the flaws.

For example, a public website or online service could receive a malicious request aimed at its PHP installation. If the vulnerability is present, the attacker may try to gain control, steal data, or interrupt the service. The article says the flaws could be exploited without login credentials, increasing the concern for externally reachable systems.

CSA’s advisory tells organisations to identify systems running any PHP version and patch them, prioritising internet-facing systems. Organisations should also check web servers for PHP used by third-party applications or components. This approach helps reduce the most immediately reachable risks while broader checks continue.

A security patch is a software update designed to correct a vulnerability or reduce the risk it creates. For PHP, the released updates address the two critical flaws identified in the advisory. Applying the patch changes vulnerable software to a protected version, where available.

The urgency rises sharply when a working exploit has been demonstrated. An exploit is a method or tool that takes advantage of a vulnerability. In this case, attackers may not need login credentials, so they could target affected systems directly. A successful attack could control a web server, steal data, or disrupt services.

The article says patches were released on October 21 and describes the threat as immediate. CSA urged organisations to identify every system running PHP, starting with internet-facing systems. It is also working with public agencies, infrastructure owners, businesses, and partners to accelerate patching.

A web server is the computer system that receives requests for webpages and sends responses to visitors. PHP is a programming language that can run on that server and help process those requests. It may generate page content or support online services before the server sends a response.

For example, a visitor may open a page that depends on a PHP-based application. The web server passes the relevant request to that application, PHP processes the application’s instructions, and the resulting response is delivered to the visitor. PHP may also be installed through a third-party application or component, even if the organisation’s primary website does not use PHP directly.

This connection matters during the current security issue. CSA told organisations to check their web servers for PHP in all forms, identify the versions installed, and apply updates. The advisory particularly prioritises systems exposed to the internet, where attackers can reach them remotely.